Kernel Driver Protection for Web Conferencing Endpoints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based conferencing services lack adequate protection for endpoints, making them vulnerable to attacks such as malicious process injection, registry key modification, and data theft, despite existing network protection for the communication channel between servers and clients.
Innovation Solution
A method and system utilizing a kernel driver and file system/registry filter to monitor and authorize file operations involving web conferencing services, ensuring only authorized operations are performed by requesting and verifying permissions from a protection service, with features like callback registration for process control and signature verification for code injection, and rule-based detection for sensitive operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network protection is provided for the communication channel between server and client, then communication security is improved, but endpoint security remains vulnerable to malware and intruders
Solution Approach 1:
The patent divides security protection into two separate segments: network channel protection (existing) and endpoint protection (new). The endpoint protection is further segmented into kernel-mode monitoring and user-mode protection services, allowing independent operation and targeted security measures for each component.
Solution Approach 2:
The patent introduces a protection service as an intermediary component that operates in user mode to verify the integrity of web conferencing applications. This intermediary acts as a bridge between the kernel driver and the application, providing an additional layer of security verification without disrupting existing communication protocols.
2Reliability
If kernel driver and file system filter are used to monitor file operations, then endpoint protection capability is improved, but system complexity increases
Solution Approach 1:
The protection service acts as an intermediary layer between the kernel driver and the web conferencing application. It handles the complex logic of verifying application integrity and authorizing operations, while the kernel driver focuses on monitoring file operations. This division reduces the complexity burden on any single component.
Solution Approach 2:
The protection service performs self-verification by checking the integrity of web conferencing applications against known good states. It autonomously determines whether to allow or block operations based on its assessment, reducing the need for complex external validation mechanisms.
3Reliability
If authorization requests are sent to protection service for each operation, then security control is improved, but processing time increases
Solution Approach 1:
The system performs preliminary verification by establishing the integrity of web conferencing applications before operations begin. The protection service pre-authors legitimate operations based on application state verification, so that during normal operation, authorized actions can proceed without repeated authorization requests, reducing time loss.
Solution Approach 2:
The system applies full authorization verification only when suspicious operations are detected or when application integrity is questionable. For normal, expected operations, the system uses a streamlined authorization process, applying verification effort proportionally to the actual security risk rather than uniformly to all operations.
Data Source
AI summary
Disclosed herein are systems and methods for providing network protection for web-based conferencing services. In one aspect, an exemplary system comprises, a device comprising a processor, an operating system (OS) operable in a user mode and a kernel mode, and a kernel driver for performing operations while the OS is in kernel mode, the kernel driver configured to: monitor file operations that involve objects belonging to a web conferencing service, receive a request from an application executing in a user mode, the request being for an operation to be executed in the kernel mode, when the operation involves at least one object belonging to the web conferencing service, request for an authorization from a protection service executing in the user mode, and allow the operation to be performed only when the authorization is received from the protection service.